claude-flow-novice 2.15.2 → 2.15.4

package/dist/middleware/auth-middleware.js

@@ -0,0 +1,350 @@
+/**
+ * Authentication and Role-Based Access Control (RBAC) Middleware
+ *
+ * Implements JWT-based authentication and role-based access control for
+ * sensitive operations like skill promotion, approval, and deployment.
+ *
+ * Features:
+ * - JWT token validation and expiration checks
+ * - Role-based access control with granular permissions
+ * - Session-based authentication fallback
+ * - Audit logging for authorization failures
+ * - Per-operation permission validation
+ *
+ * Roles:
+ * - admin: Full access to all promotion operations
+ * - developer: Can initiate promotions, but not approve/deploy
+ * - readonly: Can view audit trails, but no promotion access
+ */ import { StandardError, ErrorCode } from '../lib/errors.js';
+import { createLogger } from '../lib/logging.js';
+import * as jwt from 'jsonwebtoken';
+const logger = createLogger('auth-middleware');
+/**
+ * User role enum
+ */ export var UserRole = /*#__PURE__*/ function(UserRole) {
+    UserRole["ADMIN"] = "admin";
+    UserRole["DEVELOPER"] = "developer";
+    UserRole["READONLY"] = "readonly";
+    return UserRole;
+}({});
+/**
+ * Promotion operation enum
+ */ export var PromotionOperation = /*#__PURE__*/ function(PromotionOperation) {
+    PromotionOperation["INITIATE"] = "initiate-promotion";
+    PromotionOperation["VALIDATE"] = "validate-skill";
+    PromotionOperation["TEST"] = "test-skill";
+    PromotionOperation["APPROVE"] = "approve-promotion";
+    PromotionOperation["DEPLOY"] = "deploy-to-production";
+    PromotionOperation["ROLLBACK"] = "rollback-deployment";
+    return PromotionOperation;
+}({});
+/**
+ * Permission mapping: role -> allowed operations
+ */ const ROLE_PERMISSIONS = {
+    ["admin"]: [
+        "initiate-promotion",
+        "validate-skill",
+        "test-skill",
+        "approve-promotion",
+        "deploy-to-production",
+        "rollback-deployment"
+    ],
+    ["developer"]: [
+        "initiate-promotion",
+        "validate-skill",
+        "test-skill"
+    ],
+    ["readonly"]: []
+};
+/**
+ * Authentication middleware for validating user identity
+ *
+ * SECURITY CRITICAL: JWT_SECRET must be configured via environment variable
+ * or explicitly provided. No default secrets are allowed in production.
+ */ export class AuthMiddleware {
+    jwtSecret;
+    tokenExpirationSeconds;
+    sessions;
+    // List of insecure default secrets that must be rejected (CVSS 9.8 vulnerability)
+    static INSECURE_SECRETS = [
+        'dev-secret-key',
+        'secret',
+        'password',
+        'test',
+        'default',
+        '123456',
+        'changeme'
+    ];
+    /**
+   * Create authentication middleware
+   *
+   * @param jwtSecret - JWT signing secret (REQUIRED). If not provided, will attempt
+   *                    to load from JWT_SECRET environment variable. Throws error if
+   *                    neither is available.
+   * @param tokenExpirationSeconds - Token expiration time in seconds (default: 3600)
+   * @throws StandardError with CONFIGURATION_ERROR if JWT_SECRET is not configured
+   * @throws StandardError with VALIDATION_FAILED if JWT_SECRET is empty, too short
+   *         (<16 chars), or matches known insecure defaults
+   *
+   * @example
+   * // Explicit secret (for testing)
+   * const auth = new AuthMiddleware('strong-secret-key-at-least-16-chars');
+   *
+   * @example
+   * // From environment variable (production)
+   * process.env.JWT_SECRET = 'production-secret-at-least-16-chars';
+   * const auth = new AuthMiddleware();
+   */ constructor(jwtSecret, tokenExpirationSeconds = 3600){
+        // Attempt to resolve JWT secret from parameter or environment
+        const resolvedSecret = jwtSecret ?? process.env.JWT_SECRET;
+        // Fail fast if JWT_SECRET is not configured
+        if (!resolvedSecret) {
+            throw new StandardError(ErrorCode.CONFIGURATION_ERROR, 'JWT_SECRET is required but not configured. Please set the JWT_SECRET environment variable or provide it explicitly to the constructor.', {
+                hint: 'Set JWT_SECRET in your .env file or environment: export JWT_SECRET="your-secret-key"',
+                securityNote: 'Never use default secrets in production. Generate a strong random secret.'
+            });
+        }
+        // Trim and validate secret is not empty or whitespace
+        const trimmedSecret = resolvedSecret.trim();
+        if (trimmedSecret.length === 0) {
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'JWT_SECRET cannot be empty or whitespace only.', {
+                hint: 'Provide a strong secret key of at least 16 characters'
+            });
+        }
+        // Validate minimum length (prevent weak secrets - CVSS 7.5)
+        if (trimmedSecret.length < 16) {
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'JWT_SECRET must be at least 16 characters long for security.', {
+                providedLength: trimmedSecret.length,
+                requiredLength: 16,
+                hint: 'Use a strong random secret of at least 16 characters'
+            });
+        }
+        // Reject known insecure default secrets (CVSS 9.8 vulnerability)
+        // Only reject if secret exactly matches known insecure defaults
+        const normalizedSecret = trimmedSecret.toLowerCase().replace(/[_-]/g, '');
+        const isInsecure = AuthMiddleware.INSECURE_SECRETS.some((insecure)=>{
+            const normalizedInsecure = insecure.toLowerCase().replace(/[_-]/g, '');
+            // Only exact match - do not match if contains
+            return normalizedSecret === normalizedInsecure;
+        });
+        if (isInsecure) {
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Detected insecure default secret. Please use a strong, unique JWT_SECRET in production.', {
+                securityRisk: 'CVSS 9.8 - Default secrets allow authentication bypass and token forgery',
+                hint: 'Generate a secure random secret: openssl rand -base64 32'
+            });
+        }
+        this.jwtSecret = trimmedSecret;
+        this.tokenExpirationSeconds = tokenExpirationSeconds;
+        this.sessions = new Map();
+        logger.debug('AuthMiddleware initialized with secure JWT secret');
+    }
+    /**
+   * Generate a JWT token for a user
+   *
+   * @param userId - User ID
+   * @param username - Username
+   * @param role - User role
+   * @param email - User email (optional)
+   * @returns JWT token
+   */ generateToken(userId, username, role, email) {
+        const payload = {
+            userId,
+            username,
+            role,
+            email
+        };
+        return jwt.sign(payload, this.jwtSecret, {
+            algorithm: 'HS256',
+            expiresIn: this.tokenExpirationSeconds
+        });
+    }
+    /**
+   * Validate JWT token and extract user context
+   *
+   * @param token - JWT token
+   * @returns User context if valid
+   * @throws StandardError if token is invalid or expired
+   */ validateToken(token) {
+        try {
+            if (!token || typeof token !== 'string') {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Missing or invalid authentication token');
+            }
+            // Remove "Bearer " prefix if present
+            const cleanToken = token.startsWith('Bearer ') ? token.substring(7) : token;
+            const decoded = jwt.verify(cleanToken, this.jwtSecret, {
+                algorithms: [
+                    'HS256'
+                ]
+            });
+            // Validate required fields
+            if (!decoded.userId || !decoded.username || !decoded.role) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid token structure: missing required fields');
+            }
+            // Validate role is one of the allowed roles
+            if (!Object.values(UserRole).includes(decoded.role)) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, `Invalid role: ${decoded.role}`);
+            }
+            return {
+                userId: decoded.userId,
+                username: decoded.username,
+                role: decoded.role,
+                email: decoded.email,
+                issuedAt: decoded.iat || Math.floor(Date.now() / 1000),
+                expiresAt: decoded.exp || Math.floor(Date.now() / 1000) + this.tokenExpirationSeconds
+            };
+        } catch (error) {
+            if (error instanceof StandardError) {
+                throw error;
+            }
+            if (error instanceof jwt.TokenExpiredError) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Authentication token has expired', {
+                    expiredAt: error.expiredAt?.toISOString()
+                }, error);
+            }
+            if (error instanceof jwt.JsonWebTokenError) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid authentication token', {}, error);
+            }
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Token validation failed', {}, error);
+        }
+    }
+    /**
+   * Register a session (for session-based authentication fallback)
+   *
+   * @param sessionId - Session ID
+   * @param userContext - User context
+   */ registerSession(sessionId, userContext) {
+        this.sessions.set(sessionId, {
+            ...userContext,
+            sessionId
+        });
+        logger.debug('Session registered', {
+            sessionId,
+            userId: userContext.userId
+        });
+    }
+    /**
+   * Validate session
+   *
+   * @param sessionId - Session ID
+   * @returns User context if valid
+   * @throws StandardError if session is invalid or expired
+   */ validateSession(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session) {
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid or expired session');
+        }
+        // Check if session has expired
+        if (session.expiresAt < Math.floor(Date.now() / 1000)) {
+            this.sessions.delete(sessionId);
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Session has expired');
+        }
+        return session;
+    }
+    /**
+   * Invalidate a session
+   *
+   * @param sessionId - Session ID
+   */ invalidateSession(sessionId) {
+        this.sessions.delete(sessionId);
+        logger.debug('Session invalidated', {
+            sessionId
+        });
+    }
+    /**
+   * Extract user context from Authorization header
+   *
+   * @param authHeader - Authorization header value
+   * @returns User context
+   * @throws StandardError if authorization header is invalid
+   */ extractUserContext(authHeader, sessionId) {
+        // Try JWT token first
+        if (authHeader) {
+            return this.validateToken(authHeader);
+        }
+        // Fallback to session
+        if (sessionId) {
+            return this.validateSession(sessionId);
+        }
+        throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Missing authentication credentials (JWT token or session required)');
+    }
+}
+/**
+ * Role-Based Access Control (RBAC) enforcer
+ */ export class RBACEnforcer {
+    authMiddleware;
+    constructor(authMiddleware){
+        this.authMiddleware = authMiddleware;
+    }
+    /**
+   * Check if user has permission for an operation
+   *
+   * @param userContext - User context
+   * @param operation - Operation to perform
+   * @returns True if user has permission
+   */ hasPermission(userContext, operation) {
+        const allowedOperations = ROLE_PERMISSIONS[userContext.role];
+        return allowedOperations.includes(operation);
+    }
+    /**
+   * Enforce permission check - throws if user lacks permission
+   *
+   * @param userContext - User context
+   * @param operation - Operation to perform
+   * @param skillId - Skill ID (for audit context)
+   * @throws StandardError if user lacks permission
+   */ enforcePermission(userContext, operation, skillId) {
+        if (!this.hasPermission(userContext, operation)) {
+            logger.warn('Authorization denied', {
+                userId: userContext.userId,
+                role: userContext.role,
+                operation,
+                skillId
+            });
+            throw new StandardError(ErrorCode.VALIDATION_FAILED, `User does not have permission to perform operation: ${operation}`, {
+                userId: userContext.userId,
+                role: userContext.role,
+                operation,
+                skillId,
+                allowedOperations: ROLE_PERMISSIONS[userContext.role]
+            });
+        }
+        logger.debug('Authorization granted', {
+            userId: userContext.userId,
+            role: userContext.role,
+            operation,
+            skillId
+        });
+    }
+    /**
+   * Get description of allowed operations for a role
+   *
+   * @param role - User role
+   * @returns List of allowed operations
+   */ getAllowedOperations(role) {
+        return ROLE_PERMISSIONS[role];
+    }
+}
+/**
+ * Authorization decorator factory
+ * Wrap promotion operations to enforce RBAC
+ */ export function requirePermission(operation) {
+    return function(target, propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        descriptor.value = async function(...args) {
+            // Extract userContext and rbac from 'this' context
+            if (!this.userContext) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'User context not available - authentication required');
+            }
+            if (!this.rbacEnforcer) {
+                throw new StandardError(ErrorCode.VALIDATION_FAILED, 'RBAC enforcer not configured');
+            }
+            const skillId = args[0]?.skillId || args[1]?.skillId;
+            this.rbacEnforcer.enforcePermission(this.userContext, operation, skillId);
+            return originalMethod.apply(this, args);
+        };
+        return descriptor;
+    };
+}
+export default AuthMiddleware;
+
+//# sourceMappingURL=auth-middleware.js.map

package/dist/middleware/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/middleware/auth-middleware.ts"],"sourcesContent":["/**\n * Authentication and Role-Based Access Control (RBAC) Middleware\n *\n * Implements JWT-based authentication and role-based access control for\n * sensitive operations like skill promotion, approval, and deployment.\n *\n * Features:\n * - JWT token validation and expiration checks\n * - Role-based access control with granular permissions\n * - Session-based authentication fallback\n * - Audit logging for authorization failures\n * - Per-operation permission validation\n *\n * Roles:\n * - admin: Full access to all promotion operations\n * - developer: Can initiate promotions, but not approve/deploy\n * - readonly: Can view audit trails, but no promotion access\n */\n\nimport { StandardError, ErrorCode } from '../lib/errors.js';\nimport { createLogger } from '../lib/logging.js';\nimport * as jwt from 'jsonwebtoken';\n\nconst logger = createLogger('auth-middleware');\n\n/**\n * User role enum\n */\nexport enum UserRole {\n  ADMIN = 'admin',\n  DEVELOPER = 'developer',\n  READONLY = 'readonly',\n}\n\n/**\n * Promotion operation enum\n */\nexport enum PromotionOperation {\n  INITIATE = 'initiate-promotion',\n  VALIDATE = 'validate-skill',\n  TEST = 'test-skill',\n  APPROVE = 'approve-promotion',\n  DEPLOY = 'deploy-to-production',\n  ROLLBACK = 'rollback-deployment',\n}\n\n/**\n * User context from authentication\n */\nexport interface UserContext {\n  userId: string;\n  username: string;\n  role: UserRole;\n  email?: string;\n  issuedAt: number;\n  expiresAt: number;\n  sessionId?: string;\n}\n\n/**\n * Permission mapping: role -> allowed operations\n */\nconst ROLE_PERMISSIONS: Record<UserRole, PromotionOperation[]> = {\n  [UserRole.ADMIN]: [\n    PromotionOperation.INITIATE,\n    PromotionOperation.VALIDATE,\n    PromotionOperation.TEST,\n    PromotionOperation.APPROVE,\n    PromotionOperation.DEPLOY,\n    PromotionOperation.ROLLBACK,\n  ],\n  [UserRole.DEVELOPER]: [\n    PromotionOperation.INITIATE,\n    PromotionOperation.VALIDATE,\n    PromotionOperation.TEST,\n  ],\n  [UserRole.READONLY]: [],\n};\n\n/**\n * Authentication middleware for validating user identity\n *\n * SECURITY CRITICAL: JWT_SECRET must be configured via environment variable\n * or explicitly provided. No default secrets are allowed in production.\n */\nexport class AuthMiddleware {\n  private jwtSecret: string;\n  private tokenExpirationSeconds: number;\n  private sessions: Map<string, UserContext>;\n\n  // List of insecure default secrets that must be rejected (CVSS 9.8 vulnerability)\n  private static readonly INSECURE_SECRETS = [\n    'dev-secret-key',\n    'secret',\n    'password',\n    'test',\n    'default',\n    '123456',\n    'changeme',\n  ];\n\n  /**\n   * Create authentication middleware\n   *\n   * @param jwtSecret - JWT signing secret (REQUIRED). If not provided, will attempt\n   *                    to load from JWT_SECRET environment variable. Throws error if\n   *                    neither is available.\n   * @param tokenExpirationSeconds - Token expiration time in seconds (default: 3600)\n   * @throws StandardError with CONFIGURATION_ERROR if JWT_SECRET is not configured\n   * @throws StandardError with VALIDATION_FAILED if JWT_SECRET is empty, too short\n   *         (<16 chars), or matches known insecure defaults\n   *\n   * @example\n   * // Explicit secret (for testing)\n   * const auth = new AuthMiddleware('strong-secret-key-at-least-16-chars');\n   *\n   * @example\n   * // From environment variable (production)\n   * process.env.JWT_SECRET = 'production-secret-at-least-16-chars';\n   * const auth = new AuthMiddleware();\n   */\n  constructor(jwtSecret?: string, tokenExpirationSeconds: number = 3600) {\n    // Attempt to resolve JWT secret from parameter or environment\n    const resolvedSecret = jwtSecret ?? process.env.JWT_SECRET;\n\n    // Fail fast if JWT_SECRET is not configured\n    if (!resolvedSecret) {\n      throw new StandardError(\n        ErrorCode.CONFIGURATION_ERROR,\n        'JWT_SECRET is required but not configured. Please set the JWT_SECRET environment variable or provide it explicitly to the constructor.',\n        {\n          hint: 'Set JWT_SECRET in your .env file or environment: export JWT_SECRET=\"your-secret-key\"',\n          securityNote: 'Never use default secrets in production. Generate a strong random secret.',\n        }\n      );\n    }\n\n    // Trim and validate secret is not empty or whitespace\n    const trimmedSecret = resolvedSecret.trim();\n    if (trimmedSecret.length === 0) {\n      throw new StandardError(\n        ErrorCode.VALIDATION_FAILED,\n        'JWT_SECRET cannot be empty or whitespace only.',\n        {\n          hint: 'Provide a strong secret key of at least 16 characters',\n        }\n      );\n    }\n\n    // Validate minimum length (prevent weak secrets - CVSS 7.5)\n    if (trimmedSecret.length < 16) {\n      throw new StandardError(\n        ErrorCode.VALIDATION_FAILED,\n        'JWT_SECRET must be at least 16 characters long for security.',\n        {\n          providedLength: trimmedSecret.length,\n          requiredLength: 16,\n          hint: 'Use a strong random secret of at least 16 characters',\n        }\n      );\n    }\n\n    // Reject known insecure default secrets (CVSS 9.8 vulnerability)\n    // Only reject if secret exactly matches known insecure defaults\n    const normalizedSecret = trimmedSecret.toLowerCase().replace(/[_-]/g, '');\n    const isInsecure = AuthMiddleware.INSECURE_SECRETS.some((insecure) => {\n      const normalizedInsecure = insecure.toLowerCase().replace(/[_-]/g, '');\n      // Only exact match - do not match if contains\n      return normalizedSecret === normalizedInsecure;\n    });\n\n    if (isInsecure) {\n      throw new StandardError(\n        ErrorCode.VALIDATION_FAILED,\n        'Detected insecure default secret. Please use a strong, unique JWT_SECRET in production.',\n        {\n          securityRisk: 'CVSS 9.8 - Default secrets allow authentication bypass and token forgery',\n          hint: 'Generate a secure random secret: openssl rand -base64 32',\n        }\n      );\n    }\n\n    this.jwtSecret = trimmedSecret;\n    this.tokenExpirationSeconds = tokenExpirationSeconds;\n    this.sessions = new Map();\n\n    logger.debug('AuthMiddleware initialized with secure JWT secret');\n  }\n\n  /**\n   * Generate a JWT token for a user\n   *\n   * @param userId - User ID\n   * @param username - Username\n   * @param role - User role\n   * @param email - User email (optional)\n   * @returns JWT token\n   */\n  generateToken(userId: string, username: string, role: UserRole, email?: string): string {\n    const payload = {\n      userId,\n      username,\n      role,\n      email,\n    };\n\n    return jwt.sign(payload, this.jwtSecret, {\n      algorithm: 'HS256',\n      expiresIn: this.tokenExpirationSeconds,\n    });\n  }\n\n  /**\n   * Validate JWT token and extract user context\n   *\n   * @param token - JWT token\n   * @returns User context if valid\n   * @throws StandardError if token is invalid or expired\n   */\n  validateToken(token: string): UserContext {\n    try {\n      if (!token || typeof token !== 'string') {\n        throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Missing or invalid authentication token');\n      }\n\n      // Remove \"Bearer \" prefix if present\n      const cleanToken = token.startsWith('Bearer ') ? token.substring(7) : token;\n\n      const decoded = jwt.verify(cleanToken, this.jwtSecret, {\n        algorithms: ['HS256'],\n      }) as any;\n\n      // Validate required fields\n      if (!decoded.userId || !decoded.username || !decoded.role) {\n        throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid token structure: missing required fields');\n      }\n\n      // Validate role is one of the allowed roles\n      if (!Object.values(UserRole).includes(decoded.role)) {\n        throw new StandardError(ErrorCode.VALIDATION_FAILED, `Invalid role: ${decoded.role}`);\n      }\n\n      return {\n        userId: decoded.userId,\n        username: decoded.username,\n        role: decoded.role,\n        email: decoded.email,\n        issuedAt: decoded.iat || Math.floor(Date.now() / 1000),\n        expiresAt: decoded.exp || Math.floor(Date.now() / 1000) + this.tokenExpirationSeconds,\n      };\n    } catch (error) {\n      if (error instanceof StandardError) {\n        throw error;\n      }\n\n      if (error instanceof jwt.TokenExpiredError) {\n        throw new StandardError(\n          ErrorCode.VALIDATION_FAILED,\n          'Authentication token has expired',\n          { expiredAt: error.expiredAt?.toISOString() },\n          error\n        );\n      }\n\n      if (error instanceof jwt.JsonWebTokenError) {\n        throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid authentication token', {}, error);\n      }\n\n      throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Token validation failed', {}, error as Error);\n    }\n  }\n\n  /**\n   * Register a session (for session-based authentication fallback)\n   *\n   * @param sessionId - Session ID\n   * @param userContext - User context\n   */\n  registerSession(sessionId: string, userContext: UserContext): void {\n    this.sessions.set(sessionId, { ...userContext, sessionId });\n    logger.debug('Session registered', { sessionId, userId: userContext.userId });\n  }\n\n  /**\n   * Validate session\n   *\n   * @param sessionId - Session ID\n   * @returns User context if valid\n   * @throws StandardError if session is invalid or expired\n   */\n  validateSession(sessionId: string): UserContext {\n    const session = this.sessions.get(sessionId);\n\n    if (!session) {\n      throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Invalid or expired session');\n    }\n\n    // Check if session has expired\n    if (session.expiresAt < Math.floor(Date.now() / 1000)) {\n      this.sessions.delete(sessionId);\n      throw new StandardError(ErrorCode.VALIDATION_FAILED, 'Session has expired');\n    }\n\n    return session;\n  }\n\n  /**\n   * Invalidate a session\n   *\n   * @param sessionId - Session ID\n   */\n  invalidateSession(sessionId: string): void {\n    this.sessions.delete(sessionId);\n    logger.debug('Session invalidated', { sessionId });\n  }\n\n  /**\n   * Extract user context from Authorization header\n   *\n   * @param authHeader - Authorization header value\n   * @returns User context\n   * @throws StandardError if authorization header is invalid\n   */\n  extractUserContext(authHeader?: string, sessionId?: string): UserContext {\n    // Try JWT token first\n    if (authHeader) {\n      return this.validateToken(authHeader);\n    }\n\n    // Fallback to session\n    if (sessionId) {\n      return this.validateSession(sessionId);\n    }\n\n    throw new StandardError(\n      ErrorCode.VALIDATION_FAILED,\n      'Missing authentication credentials (JWT token or session required)'\n    );\n  }\n}\n\n/**\n * Role-Based Access Control (RBAC) enforcer\n */\nexport class RBACEnforcer {\n  private authMiddleware: AuthMiddleware;\n\n  constructor(authMiddleware: AuthMiddleware) {\n    this.authMiddleware = authMiddleware;\n  }\n\n  /**\n   * Check if user has permission for an operation\n   *\n   * @param userContext - User context\n   * @param operation - Operation to perform\n   * @returns True if user has permission\n   */\n  hasPermission(userContext: UserContext, operation: PromotionOperation): boolean {\n    const allowedOperations = ROLE_PERMISSIONS[userContext.role];\n    return allowedOperations.includes(operation);\n  }\n\n  /**\n   * Enforce permission check - throws if user lacks permission\n   *\n   * @param userContext - User context\n   * @param operation - Operation to perform\n   * @param skillId - Skill ID (for audit context)\n   * @throws StandardError if user lacks permission\n   */\n  enforcePermission(userContext: UserContext, operation: PromotionOperation, skillId?: string): void {\n    if (!this.hasPermission(userContext, operation)) {\n      logger.warn('Authorization denied', {\n        userId: userContext.userId,\n        role: userContext.role,\n        operation,\n        skillId,\n      });\n\n      throw new StandardError(\n        ErrorCode.VALIDATION_FAILED,\n        `User does not have permission to perform operation: ${operation}`,\n        {\n          userId: userContext.userId,\n          role: userContext.role,\n          operation,\n          skillId,\n          allowedOperations: ROLE_PERMISSIONS[userContext.role],\n        }\n      );\n    }\n\n    logger.debug('Authorization granted', {\n      userId: userContext.userId,\n      role: userContext.role,\n      operation,\n      skillId,\n    });\n  }\n\n  /**\n   * Get description of allowed operations for a role\n   *\n   * @param role - User role\n   * @returns List of allowed operations\n   */\n  getAllowedOperations(role: UserRole): PromotionOperation[] {\n    return ROLE_PERMISSIONS[role];\n  }\n}\n\n/**\n * Authorization decorator factory\n * Wrap promotion operations to enforce RBAC\n */\nexport function requirePermission(operation: PromotionOperation) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    const originalMethod = descriptor.value;\n\n    descriptor.value = async function (this: any, ...args: any[]) {\n      // Extract userContext and rbac from 'this' context\n      if (!this.userContext) {\n        throw new StandardError(\n          ErrorCode.VALIDATION_FAILED,\n          'User context not available - authentication required'\n        );\n      }\n\n      if (!this.rbacEnforcer) {\n        throw new StandardError(\n          ErrorCode.VALIDATION_FAILED,\n          'RBAC enforcer not configured'\n        );\n      }\n\n      const skillId = args[0]?.skillId || args[1]?.skillId;\n      this.rbacEnforcer.enforcePermission(this.userContext, operation, skillId);\n\n      return originalMethod.apply(this, args);\n    };\n\n    return descriptor;\n  };\n}\n\nexport default AuthMiddleware;\n"],"names":["StandardError","ErrorCode","createLogger","jwt","logger","UserRole","PromotionOperation","ROLE_PERMISSIONS","AuthMiddleware","jwtSecret","tokenExpirationSeconds","sessions","INSECURE_SECRETS","resolvedSecret","process","env","JWT_SECRET","CONFIGURATION_ERROR","hint","securityNote","trimmedSecret","trim","length","VALIDATION_FAILED","providedLength","requiredLength","normalizedSecret","toLowerCase","replace","isInsecure","some","insecure","normalizedInsecure","securityRisk","Map","debug","generateToken","userId","username","role","email","payload","sign","algorithm","expiresIn","validateToken","token","cleanToken","startsWith","substring","decoded","verify","algorithms","Object","values","includes","issuedAt","iat","Math","floor","Date","now","expiresAt","exp","error","TokenExpiredError","expiredAt","toISOString","JsonWebTokenError","registerSession","sessionId","userContext","set","validateSession","session","get","delete","invalidateSession","extractUserContext","authHeader","RBACEnforcer","authMiddleware","hasPermission","operation","allowedOperations","enforcePermission","skillId","warn","getAllowedOperations","requirePermission","target","propertyKey","descriptor","originalMethod","value","args","rbacEnforcer","apply"],"mappings":"AAAA;;;;;;;;;;;;;;;;;CAiBC,GAED,SAASA,aAAa,EAAEC,SAAS,QAAQ,mBAAmB;AAC5D,SAASC,YAAY,QAAQ,oBAAoB;AACjD,YAAYC,SAAS,eAAe;AAEpC,MAAMC,SAASF,aAAa;AAE5B;;CAEC,GACD,OAAO,IAAA,AAAKG,kCAAAA;;;;WAAAA;MAIX;AAED;;CAEC,GACD,OAAO,IAAA,AAAKC,4CAAAA;;;;;;;WAAAA;MAOX;AAeD;;CAEC,GACD,MAAMC,mBAA2D;IAC/D,SAAgB,EAAE;;;;;;;KAOjB;IACD,aAAoB,EAAE;;;;KAIrB;IACD,YAAmB,EAAE,EAAE;AACzB;AAEA;;;;;CAKC,GACD,OAAO,MAAMC;IACHC,UAAkB;IAClBC,uBAA+B;IAC/BC,SAAmC;IAE3C,kFAAkF;IAClF,OAAwBC,mBAAmB;QACzC;QACA;QACA;QACA;QACA;QACA;QACA;KACD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;GAmBC,GACD,YAAYH,SAAkB,EAAEC,yBAAiC,IAAI,CAAE;QACrE,8DAA8D;QAC9D,MAAMG,iBAAiBJ,aAAaK,QAAQC,GAAG,CAACC,UAAU;QAE1D,4CAA4C;QAC5C,IAAI,CAACH,gBAAgB;YACnB,MAAM,IAAIb,cACRC,UAAUgB,mBAAmB,EAC7B,0IACA;gBACEC,MAAM;gBACNC,cAAc;YAChB;QAEJ;QAEA,sDAAsD;QACtD,MAAMC,gBAAgBP,eAAeQ,IAAI;QACzC,IAAID,cAAcE,MAAM,KAAK,GAAG;YAC9B,MAAM,IAAItB,cACRC,UAAUsB,iBAAiB,EAC3B,kDACA;gBACEL,MAAM;YACR;QAEJ;QAEA,4DAA4D;QAC5D,IAAIE,cAAcE,MAAM,GAAG,IAAI;YAC7B,MAAM,IAAItB,cACRC,UAAUsB,iBAAiB,EAC3B,gEACA;gBACEC,gBAAgBJ,cAAcE,MAAM;gBACpCG,gBAAgB;gBAChBP,MAAM;YACR;QAEJ;QAEA,iEAAiE;QACjE,gEAAgE;QAChE,MAAMQ,mBAAmBN,cAAcO,WAAW,GAAGC,OAAO,CAAC,SAAS;QACtE,MAAMC,aAAarB,eAAeI,gBAAgB,CAACkB,IAAI,CAAC,CAACC;YACvD,MAAMC,qBAAqBD,SAASJ,WAAW,GAAGC,OAAO,CAAC,SAAS;YACnE,8CAA8C;YAC9C,OAAOF,qBAAqBM;QAC9B;QAEA,IAAIH,YAAY;YACd,MAAM,IAAI7B,cACRC,UAAUsB,iBAAiB,EAC3B,2FACA;gBACEU,cAAc;gBACdf,MAAM;YACR;QAEJ;QAEA,IAAI,CAACT,SAAS,GAAGW;QACjB,IAAI,CAACV,sBAAsB,GAAGA;QAC9B,IAAI,CAACC,QAAQ,GAAG,IAAIuB;QAEpB9B,OAAO+B,KAAK,CAAC;IACf;IAEA;;;;;;;;GAQC,GACDC,cAAcC,MAAc,EAAEC,QAAgB,EAAEC,IAAc,EAAEC,KAAc,EAAU;QACtF,MAAMC,UAAU;YACdJ;YACAC;YACAC;YACAC;QACF;QAEA,OAAOrC,IAAIuC,IAAI,CAACD,SAAS,IAAI,CAAChC,SAAS,EAAE;YACvCkC,WAAW;YACXC,WAAW,IAAI,CAAClC,sBAAsB;QACxC;IACF;IAEA;;;;;;GAMC,GACDmC,cAAcC,KAAa,EAAe;QACxC,IAAI;YACF,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU;gBACvC,MAAM,IAAI9C,cAAcC,UAAUsB,iBAAiB,EAAE;YACvD;YAEA,qCAAqC;YACrC,MAAMwB,aAAaD,MAAME,UAAU,CAAC,aAAaF,MAAMG,SAAS,CAAC,KAAKH;YAEtE,MAAMI,UAAU/C,IAAIgD,MAAM,CAACJ,YAAY,IAAI,CAACtC,SAAS,EAAE;gBACrD2C,YAAY;oBAAC;iBAAQ;YACvB;YAEA,2BAA2B;YAC3B,IAAI,CAACF,QAAQb,MAAM,IAAI,CAACa,QAAQZ,QAAQ,IAAI,CAACY,QAAQX,IAAI,EAAE;gBACzD,MAAM,IAAIvC,cAAcC,UAAUsB,iBAAiB,EAAE;YACvD;YAEA,4CAA4C;YAC5C,IAAI,CAAC8B,OAAOC,MAAM,CAACjD,UAAUkD,QAAQ,CAACL,QAAQX,IAAI,GAAG;gBACnD,MAAM,IAAIvC,cAAcC,UAAUsB,iBAAiB,EAAE,CAAC,cAAc,EAAE2B,QAAQX,IAAI,EAAE;YACtF;YAEA,OAAO;gBACLF,QAAQa,QAAQb,MAAM;gBACtBC,UAAUY,QAAQZ,QAAQ;gBAC1BC,MAAMW,QAAQX,IAAI;gBAClBC,OAAOU,QAAQV,KAAK;gBACpBgB,UAAUN,QAAQO,GAAG,IAAIC,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK;gBACjDC,WAAWZ,QAAQa,GAAG,IAAIL,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,QAAQ,IAAI,CAACnD,sBAAsB;YACvF;QACF,EAAE,OAAOsD,OAAO;YACd,IAAIA,iBAAiBhE,eAAe;gBAClC,MAAMgE;YACR;YAEA,IAAIA,iBAAiB7D,IAAI8D,iBAAiB,EAAE;gBAC1C,MAAM,IAAIjE,cACRC,UAAUsB,iBAAiB,EAC3B,oCACA;oBAAE2C,WAAWF,MAAME,SAAS,EAAEC;gBAAc,GAC5CH;YAEJ;YAEA,IAAIA,iBAAiB7D,IAAIiE,iBAAiB,EAAE;gBAC1C,MAAM,IAAIpE,cAAcC,UAAUsB,iBAAiB,EAAE,gCAAgC,CAAC,GAAGyC;YAC3F;YAEA,MAAM,IAAIhE,cAAcC,UAAUsB,iBAAiB,EAAE,2BAA2B,CAAC,GAAGyC;QACtF;IACF;IAEA;;;;;GAKC,GACDK,gBAAgBC,SAAiB,EAAEC,WAAwB,EAAQ;QACjE,IAAI,CAAC5D,QAAQ,CAAC6D,GAAG,CAACF,WAAW;YAAE,GAAGC,WAAW;YAAED;QAAU;QACzDlE,OAAO+B,KAAK,CAAC,sBAAsB;YAAEmC;YAAWjC,QAAQkC,YAAYlC,MAAM;QAAC;IAC7E;IAEA;;;;;;GAMC,GACDoC,gBAAgBH,SAAiB,EAAe;QAC9C,MAAMI,UAAU,IAAI,CAAC/D,QAAQ,CAACgE,GAAG,CAACL;QAElC,IAAI,CAACI,SAAS;YACZ,MAAM,IAAI1E,cAAcC,UAAUsB,iBAAiB,EAAE;QACvD;QAEA,+BAA+B;QAC/B,IAAImD,QAAQZ,SAAS,GAAGJ,KAAKC,KAAK,CAACC,KAAKC,GAAG,KAAK,OAAO;YACrD,IAAI,CAAClD,QAAQ,CAACiE,MAAM,CAACN;YACrB,MAAM,IAAItE,cAAcC,UAAUsB,iBAAiB,EAAE;QACvD;QAEA,OAAOmD;IACT;IAEA;;;;GAIC,GACDG,kBAAkBP,SAAiB,EAAQ;QACzC,IAAI,CAAC3D,QAAQ,CAACiE,MAAM,CAACN;QACrBlE,OAAO+B,KAAK,CAAC,uBAAuB;YAAEmC;QAAU;IAClD;IAEA;;;;;;GAMC,GACDQ,mBAAmBC,UAAmB,EAAET,SAAkB,EAAe;QACvE,sBAAsB;QACtB,IAAIS,YAAY;YACd,OAAO,IAAI,CAAClC,aAAa,CAACkC;QAC5B;QAEA,sBAAsB;QACtB,IAAIT,WAAW;YACb,OAAO,IAAI,CAACG,eAAe,CAACH;QAC9B;QAEA,MAAM,IAAItE,cACRC,UAAUsB,iBAAiB,EAC3B;IAEJ;AACF;AAEA;;CAEC,GACD,OAAO,MAAMyD;IACHC,eAA+B;IAEvC,YAAYA,cAA8B,CAAE;QAC1C,IAAI,CAACA,cAAc,GAAGA;IACxB;IAEA;;;;;;GAMC,GACDC,cAAcX,WAAwB,EAAEY,SAA6B,EAAW;QAC9E,MAAMC,oBAAoB7E,gBAAgB,CAACgE,YAAYhC,IAAI,CAAC;QAC5D,OAAO6C,kBAAkB7B,QAAQ,CAAC4B;IACpC;IAEA;;;;;;;GAOC,GACDE,kBAAkBd,WAAwB,EAAEY,SAA6B,EAAEG,OAAgB,EAAQ;QACjG,IAAI,CAAC,IAAI,CAACJ,aAAa,CAACX,aAAaY,YAAY;YAC/C/E,OAAOmF,IAAI,CAAC,wBAAwB;gBAClClD,QAAQkC,YAAYlC,MAAM;gBAC1BE,MAAMgC,YAAYhC,IAAI;gBACtB4C;gBACAG;YACF;YAEA,MAAM,IAAItF,cACRC,UAAUsB,iBAAiB,EAC3B,CAAC,oDAAoD,EAAE4D,WAAW,EAClE;gBACE9C,QAAQkC,YAAYlC,MAAM;gBAC1BE,MAAMgC,YAAYhC,IAAI;gBACtB4C;gBACAG;gBACAF,mBAAmB7E,gBAAgB,CAACgE,YAAYhC,IAAI,CAAC;YACvD;QAEJ;QAEAnC,OAAO+B,KAAK,CAAC,yBAAyB;YACpCE,QAAQkC,YAAYlC,MAAM;YAC1BE,MAAMgC,YAAYhC,IAAI;YACtB4C;YACAG;QACF;IACF;IAEA;;;;;GAKC,GACDE,qBAAqBjD,IAAc,EAAwB;QACzD,OAAOhC,gBAAgB,CAACgC,KAAK;IAC/B;AACF;AAEA;;;CAGC,GACD,OAAO,SAASkD,kBAAkBN,SAA6B;IAC7D,OAAO,SAAUO,MAAW,EAAEC,WAAmB,EAAEC,UAA8B;QAC/E,MAAMC,iBAAiBD,WAAWE,KAAK;QAEvCF,WAAWE,KAAK,GAAG,eAA2B,GAAGC,IAAW;YAC1D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAACxB,WAAW,EAAE;gBACrB,MAAM,IAAIvE,cACRC,UAAUsB,iBAAiB,EAC3B;YAEJ;YAEA,IAAI,CAAC,IAAI,CAACyE,YAAY,EAAE;gBACtB,MAAM,IAAIhG,cACRC,UAAUsB,iBAAiB,EAC3B;YAEJ;YAEA,MAAM+D,UAAUS,IAAI,CAAC,EAAE,EAAET,WAAWS,IAAI,CAAC,EAAE,EAAET;YAC7C,IAAI,CAACU,YAAY,CAACX,iBAAiB,CAAC,IAAI,CAACd,WAAW,EAAEY,WAAWG;YAEjE,OAAOO,eAAeI,KAAK,CAAC,IAAI,EAAEF;QACpC;QAEA,OAAOH;IACT;AACF;AAEA,eAAepF,eAAe"}